This is "How China Detects and Blocks Shadowsocks",
by GFW Report, Jan Beznazwy and Amir Houmansadr.
I'm David Fifield and I'm presenting this work on behalf of the authors,
most of whom are anonymous.
I have experience researching in this field and
the authors have acquainted me thoroughly with this work.
The grand summary of this research is that
the Great Firewall of China detects and blocks Shadowsocks
using a combination of passive traffic analysis and active probing.
And let's talk about what those terms mean.
Shadowsocks is an encrypted proxy protocol and it's designed to be difficult to detect.
It's really popular in China as a means of censorship circumvention,
a way of getting around the Great Firewall.
And the Great Firewall for its part,
as part of its general mission of information control
tries to find and block all types of different proxy servers, Shadowsocks included.
And in fact, since about May 2019,
there have been anecdotal reports of people's Shadowsocks servers being blocked from China
sometimes during politically sensitive times, but without a good explanation.
This research helps provide an explanation for how this has been happening.
Now in Shadowsocks, the connection between the client and the server is encrypted
and furthermore it's encrypted in a way that it reveals only ciphertext to an observer.
So unlike TLS, for example, which has plaintext framing bytes,
there's nothing like that in Shadowsocks.
If you flatten out a Shadowsocks stream, it looks like just a sequence of uniformly
random bytes and that's by design.
This quality means that it's not possible to, for example,
write a simple regular expression that will match all Shadowsocks traffic,
you have to work a little harder than that.
Now what do I mean by active probing?
This research shows that
the Great Firewall discovers Shadowsocks servers in a two-step process:
the first step is passive and the second step is active.
In the first step, it looks for possible or potential Shadowsocks connections;
and in the second step,
it connects to the servers involved in those connections from its own IP addresses
as if it were a Shadowsocks client and watches how the server responds.
You can think of step 1 as guess and step 2 as confirm.
Now you can understand this process of active probing as a way of
increasing precision or reducing cost in network classification.
If you were to write a purely passive classifier for Shadowsocks,
it may yield unacceptably high false positives.
On the other hand, if you were to try to
active probe every single connection that passes through the firewall
that may be more probes than you can manage to send.
So you can think of step one as being a sort of pre-filter for step two.
Now this is certainly not the first time that active probing has been documented
to be used in China against censorship circumvention protocols.
There is research going back all the way to 2011,
showing it being used against Tor, against various VPN protocols like that.
But the level of detection now in using Shadowsocks
reaches a new heights of sophistication.
How do we know all this? Well, the authors investigated
it in the way you might expect. They ran an experiment,
they set up their own Shadowsocks servers outside of China;
They set up their own Shadowsocks clients inside China and then
they connected to their own servers through the Firewall and
watched for what else connected to those same servers.
They also set up some control servers and never connected to them,
just to be able to distinguish the connection triggered active probes
from random internet scanning.
And they ran this experiment for about four months.
The main observations of the research are that
active probing is triggered by the first data-carrying packet in a TCP connection.
And packets that have high entropy or certain packet lengths are more likely to result in active probing.
There are many different types of probes. Some are based on replay, and some are not.
The probes seem like they're designed to target vulnerabilities
in different Shadowsocks implementations.
Probes come from many different source IP addresses, over 12,000 different IP addresses
throughout the 4-month experiment.
And you can mitigate active probing by altering packet lengths
or by tightening up how servers react to unauthenticated probes.
This is the project web site with source code, data, and contact information,
as well as the conference video with Chinese subtitles.
This link at the bottom, the authors are monitoring this Etherpad right now
for your text-based questions. Thank you.